drscrewdriver/dsh-perm-gate
A single, deterministic-first, fail-closed permission gate for DeepSeek Harness that decides every tool call through a fixed priority chain: P0 hard-deny (credentials, protected-path mutation, dangerous shell), P1 bounded session grants, P2 a static blacklist/allow/ask rule chain, an optional P3 LLM classifier (off by default) and the official P4 approval seam. It merges gate + approval + classifier into one package with argv-decomposed matching, audit events, and a strictly fail-closed guarantee — a P0 deny is never overridden.
dsh-perm-gate is a single, self-sufficient, deterministic-first, fail-closed permission gate for DeepSeek Harness that decides every tool call through a fixed priority chain: P0 hard-deny (credential material, protected-path mutation, dangerous shell), P1 a precise, bounded session grant, P2 a static rule chain (blacklist first, then allow, then ask), P3 an optional LLM semantic classifier (default off) and P4 the official approval seam. It is strictly fail-closed — a P0 decision is never overridden by a grant, a rule, the classifier, or a human. Rules match on an argv decomposition rather than a raw string, with recursive descent into sh -c/bash -c, pipeline detection, redirect-target checking and recursive/force (rm -rf) recognition; a matching deny rule wins over any allow rule. Session grants carry a (tool, canonical fingerprint) plus TTL and maxUses so re-running with a different target never reuses authority, and sub-agents inherit but cannot mint. The rule engine is a pure function with a ReDoS-bounded compile cache and a loud fail on malformed rules, and every decision is logged as an {ignorable:true} event whose model-visible reason matches the recorded outcome. It also adds a 自动审查 tier (permissive, plus permissive-full) — an independent approval mode between read-only/full-access/whitelist, driven by combinable backend strategies and still fail-closed against P0.
Install
dsh plugin --profile web add dsh-perm-gateCopied verbatim from the README's install block (npm form; the package ships its own bundle patch, so dsh plugin add registers the loader row).
Compatibility
Two DSH lines are served from two long-lived branches, each with its own version series and npm dist-tag: the legacy 1.x line for DSH 0.1.0-rc.7 ~ 0.1.1 and the main 2.x line for DSH 0.1.2-alpha.1+ (including 0.1.5-rc.2). The majors fence each other, so a ^1.x install never resolves a 2.x release and vice versa. Version-sensitive seams are handled by capability probes rather than version checks. The README also notes that official DSH exposes only zh/en through LocaleRuntime, so the shipped ja/ko dictionaries need a DSH fork that updates LOCALE_IDS.
Details
- Repo: drscrewdriver/dsh-perm-gate
- Category: Tools & Capabilities
- Stars: 3
- Version: GitHub repo drscrewdriver/dsh-perm-gate (3★); npm package dsh-perm-gate at 5.1.2 (registry check 2026-10-11; registry repository field resolves back to this repo). Version 2.6.0 per the README changelog note; supported hosts listed as 15 rc releases across the 0.1.0 / 0.1.1 / 0.1.2 / 0.1.5 / 0.1.7 / 0.2.0 lines, runtime-verified on 0.2.0-rc.2.
Alternatives
1321928757/dsh-mysql · 1624318455/dsh-plugin-tavily · 6Mikao9/dsh-wsl-workspace